Core security principles—network segmentation, least privilege, separation of duties, monitoring, and equipment hardening—form the foundation of a defensible IT environment. This content explains what each principle means and why it matters for reducing organizational risk.
Security Principles
Segmentation is the idea that we're going to separate different sections. I'll use this blueprint as an example. We have different offices here that are separating the different functionality of this office, so we can have meetings without disturbing everyone else, we could have somebody working in an office so that way they don't disturb everyone else, and perhaps these doors lock, so it adds a certain amount of security between these areas.
That's the idea with your network as well. We want to think about segmentation from a cybersecurity perspective too. So maybe we have administration, operations and sales have access to all their own resources. Administration has access to their own servers, their own data, their own credentials, their own documents, perhaps even their own network, and it keeps all these sections separated so that way sales doesn't have access to sensitive information they shouldn't have access to. It also helps that if somebody in sales gets compromised, it only compromises the things that they have access to, not the whole company system.
Similarly, there's this concept of least privilege. The idea behind least privilege is that you don't give access to somebody that doesn't need access to something. So for instance, rather than giving all of these people access to the whole shared drive, we would give Sue permissions to maybe the business ideas and customers and maybe finance, Sonia to business ideas and taxes and maybe vendors, and Neil to partners and vendors. So each one of these people are going to only have access to what they need to carry out their job duties.
Which brings us to our next point, separation of duties. The idea behind this is that no one person has access to a full process. An example might be if a single person chose out a vendor, was able to prepare purchase orders, approve those purchase orders and write the checks. Then what they could do is create a fictitious company and create an order for that fictitious company, approve it, and then write themselves a check and be able to embezzle that money.
So instead, we cut parts of this out and say, well, somebody else actually has to go through the approval process. You can't have the same person who creates the purchase order approve the purchase order, and you can't have the same person write the check. So this is separating this out so that each of these functions might be carried out by a different person.
Something that's more closely related to IT would be when somebody needs access. Let's say there's a new employee and they need access to something, so what they need to do is submit a request, and that goes into IT, and then somebody approves it. Maybe it's their manager, or whoever owns the resource has to approve of that; it's a different person than just the person who's making the request. And then once they get the approval, then you have the implementers, and often that's the IT department, and they're the ones that are actually implementing.
As all of this is happening, we want to monitor everything. We want to make sure that we're monitoring uptime and performance, monitoring for malware, monitoring for file changes, monitoring for configuration changes, so that way we catch anything that happens within any one of these areas. There are systems out there that will actually monitor what the typical changes look like and then flag, notify or alert if there's some sort of change that looks like it's out of the ordinary, and let you know. So monitoring is a big part of managing our risk.
And of course, if we unbox a new piece of equipment and put it on the shelf and turn it on, we are going to open ourselves up for vulnerability. So what we need to do is equipment hardening, to make sure that the equipment that we're setting up is being set up in a secure manner.
We started out by talking about segmentation, being able to split up your network and your resources into different sections. Then we talked about least privilege: don't give people access to those different areas if they don't need access to it, only give them access to the areas they need access to. We talked about separation of duty and how no one should be responsible for the full chain of events, for things like writing checks or giving permissions to certain resources; there should be checks and balances in there. And then monitoring: we should be monitoring our networks and our services for issues and inconsistencies that come up. And finally we talked about equipment hardening. We're going to get much more in depth into a lot of these; there's going to be a whole module on equipment hardening and getting into the equipment and the networking side of it to make sure that it's set up securely.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →